Response to the ICO’s Age Appropriate Design: Code of Practice for Online 
Services 


Context 


1. 


The Association of Online Publishers (“AOP”) is an industry body representing digital 
publishing businesses which create premium original content. 


The AOP has consulted with its members in relation to the Age Appropriate Design code of 
practice for online services issued by the ICO (the “Code”) and received detailed feedback 
from a number of them, including several news publishers. 


We have taken a proactive approach in providing our members’ feedback on the Code and 
whilst identifying the areas where we consider that the Code will be problematic for 
publishers, we have set out suggested alternatives to the approach taken by the Code or 
supplementary options to make the Code more workable in its practical application. 


Observations 


4. 


Digital publishers are caught within the definition of a provider of information society services 
(“ISS”) as set out in the Code. If the Code were to be applicable in its current form , this would 
have problematic and far reaching consequences for all publisher sites . Our members’ 
concerns include the following: 


Application of the Code: 


The key concern is identifying whether the Code is applicable to publisher sites. The Code 
applies to all online services likely to be accessed by children. ‘Likely to be accessed’ is a 
vague term. While the Code states that an ISS can demonstrate that it believes that only 
adults are likely to use the service (and therefore that the Code does not apply) by relying on 
a) market research, b) the nature and context of the service and/or c) specific measures taken 
to limit access by children, this is likely to be problematic for publishers to demonstrate in 
practice. This would also leave open the question of how many children need to access a 
particular site for it to be “likely” that children will access that site for the purposes of the 
Code. 

Publishers compete for users, and advertising revenue, with all manner of online and offline 
publishers. Many of those are not based in or publish from the UK, and there is a real danger 
of creating an unlevel playing field and placing UK publishers at a considerable disadvantage 
as compared with those competitors. 


Age verification: 


In its current form, the Code requires publishers to apply all 16 standards in the Code to all 
users, unless there are robust age-verification mechanisms in place to distinguish children 
from adults. 


Identifying children online is an infamously difficult task. As the Code points out, age 
verification tools are still a developing area and there is not currently a market solution which 
has been recommended by the ICO as being adequately robust and complying with data 
protection standards. Age verification for accessing online pornography will be required in the 
UK from 15July 2019. Even here, where it is widely accepted that measures are required to 
protect children from exposure to such content, privacy campaigners have raised substantial 
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concerns about how the data collected by the site operators and the age verification solution 
providers will be used and protected from disclosure. 


9. Amarket accepted robust age verification mechanism will need to take into account: 


Ensuring that the age-verification provider maintains a high standard of privacy 
and data security; 

Ensuring that there is a single framework for age verification standards (ideally 
applicable across Europe) which is easy for individuals to navigate and for ISS 
providers to apply; 

Ensuring that third party age verification vendors comply with data protection 
standards, including in relation to data retention and only using the data for the 
purposes for which it has been collected; and 

Minimising over-collection of personal data (and sensitive personal data in 
particular). 


10. Until one or more such tools have been approved by the ICO, or perhaps by an industry body 
such as JICWEBS, publishers will not have sufficient guidance on how best to carry out age 
verification, and as a consequence may need to treat all of their sites as being “likely to be 
accessed by” children, regardless of whether this is the case in practice. 


Age- appropriate application: 


11. The obligation to ensure that the standards in the Code are applied to all users, where it 
cannot be verified that they are adults, would require all publisher sites to ensure that all 
content on their sites is age-appropriate. The key issues we envisage with this, in relation to 
publisher sites, are as follows: 


V. 


vi. 


Vii. 


viii. 
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It would be difficult for publishers - who are not currently required to address this 
issue - to determine what content is age appropriate. For example, the content of 
a news website is likely to include editorial content relating to war, terrorism and 
gang violence, etc. Whilst Annex A of the Code provides guidance on key 
considerations relevant to age and developmental stages, the guidance is not 
tailored to scenarios such as this. 


If publisher sites are required to censor the content being provided to users, to 
avoid the risk of “inappropriate” content being accessed by children, there is a 
risk of self-censorship of the content that the publishers provide. Publishers need 
reassurance that the Code considers its effect on editorial content and publishers 
editorial freedom. 


The Code creates a contradiction between: 
a) ensuring that children are exposed to a range of views and not provided 
with biased opinions, and 
b) ensuring that content provided to children is tailored and age appropriate. 


As regards advertising content published on publishers’ sites, the Code does not 
differentiate between: 
a) advertisements served as a consequence of direct deals between 
publishers and advertisers or their media agencies; and 
b) advertisements served by ad exchanges where inventory is bought and 
sold via programmatic auction (real time bidding). 


In the former case, publishers have more control over what is being advertised on 

their sites, and by whom. Even there however, If publishers would be restricted from 
the accepting commercial advertising on their sites that would have severe financial 
consequences for publishers of consumer sites, which are predominantly ad funded. 


Recommendations: 


12. 


13. 


14. 


15. 


16. 


17. 


Application of the Code: 


As mentioned above, the key concern for publishers is the wide application of the Code. In its 
current draft, publishers which are not targeting children can easily be caught by the Code 
given: 

a) the low threshold for being ‘likely to be accessed’ by children; and 

b) the lack of approved age verification tools on the market. 


Recommendation: 


Publishers can obtain statistics on their online audience breakdown by age profile based on 
audience measurement data provided by UK Online Measurement Limited (“UKOM”). 
UKOM’s data is in turn currently provided by comScore and is generally accepted as being 
accurate and reliable by the UK media industry. 


We propose that a benchmark is derived and agreed between the publishers and the ICO for 
a publishers’ exemption, which provides that if UKOM data indicates that less than x% of the 
average audience of a publisher’s site are under the age of 18, then the Code is not 
applicable to that site. 


Requirement for default privacy settings: 


If the Code is deemed to be applicable to publisher sites, in its current form the Code would 
require that features which rely on user profiling are switched off by default (unless there is a 
compelling reason to do otherwise). The Code makes clear that a ‘commercial purpose’ would 
not qualify as a compelling reason. The consequences of this are that unless a publisher 
knows which site users are children, it would be unable to serve any targeted advertisements 
on its users at all. Programmatic advertising is often bought on the basis of audience segment 
data indicating that an advertisement served on inventory bought through an exchange will be 
served on an audience having particular characteristics such as age and demographics for 
example. On the face of it, sites which are subject to the Code would not be able to collect the 
data required to create those audience segments. 


At the same time, the Code would appear to preclude publishers from providing 
recommendations for editorial content on their site which may be of interest to their users, 
which could downgrade the user experience. Personalised content can even help to prevent 
age-inappropriate content from being suggested to the wrong target audience. 


Recommendation: 


Given that, as we understand it, the ICO’s principal focus is on minimising the risk of children 
being exposed to inappropriate advertising, we suggest looking at a number of alternative 
measures, including: 
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e Consider requiring publishers to review their cookie policies to provide transparent 
information to individuals regarding the cookies which are likely to be placed on a user’s 
browser; 

e Consider requiring publishers to provide guidance to individuals which states that if they 
are under the age of 18 then they should consider activating an ad blocker; 

e Consider putting in place a code of practice between publishers, advertisers and media 
agencies which requires them not to use user profiling to serve advertisements on 
individuals who are or appear to be under the age of 18 on a publisher’s site; 

e Where the publishers permit contextual advertising on their sites, consider requiring that 
user browsing is reviewed and where browsing habits indicate that a user is likely to be 
under the age of 18 then they will be flagged as not to be served advertisements, or, if 
applicable only served with advertisements which are appropriate to be served on a 
minor; and 

e Ensuring that any new restrictions the ICO plans to put in place, particularly those that 
are likely to have a material impact on ad-funded online services and content, are 
proportionate, enforceable and practical, taking into account the variety of ISS providers 
that will be affected. 


The Association of Online Publishers 


31 May 2019 
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